Various computing devices, including desktop computers, laptops, and mobile communication devices such as smart phones, include software code that may act upon data stored in memory. This software may be various operating system processes or applications installed on the computing device. In such computing devices, data access and code execution is usually monitored and is beneficial for improving the security, performance, and reliability of the devices. For example, code execution and data access may be monitored for anomaly detection and access control security issues that may occur when unauthorized users or programs attempt to access or manipulate the computing device. In another example, code execution is monitored for profiling the performance of various code paths, modules, or libraries. In another example, code execution is often monitored to measure the reliability of the program.
Monitoring on computing devices may be accomplished through a monitoring engine installed on the computing device. Monitoring engines may be either software monitors or hardware monitors. Software monitors monitor the execution of high level software code on the computing device, whereas hardware monitors monitor particular low level code instructions and data memory addresses. In hardware monitoring a limited amount of code or data is monitored, which reduces its flexibility. For example, hardware monitors may only be able to monitor a small portion of memory addresses within the computing device's memory store, meaning that large portions of the device memory are not testable by the hardware monitor. Hardware monitors may also be configured to monitor certain types of instructions, for example instructions related to memory, and thus would not be able to monitor a wide variety of software instructions. In addition, the monitoring demands may vary widely between processes or even between executions of the same process. For example, depending on a process' workload, a memory being monitored may be accessed with very high or very low frequency.
Thus, hardware monitoring lacks the flexibility of software monitoring to monitor a wide range of software code and data. Hardware monitoring may also be inefficient at handling changes in software behavior, which may increase the resource overhead necessary to conduct the monitoring. Inefficient hardware monitoring takes up more device resources, such as memory or processor time, that would otherwise be allocated to the operating system of the device or applications executing on the device.